Abstract:The development of robust anomaly-based network detection systems, which are preferred over static signal-based network intrusion, is vital for cybersecurity. The development of a flexible and dynamic security system is required to tackle the new attacks. Current intrusion detection systems (IDSs) suffer to attain both the high detection rate and low false alarm rate. To address this issue, in this paper, we propose an IDS using different machine learning (ML) and deep learning (DL) models. This paper presents a comparative analysis of different ML models and DL models on Coburg intrusion detection datasets (CIDDSs). First, we compare different ML- and DL-based models on the CIDDS dataset. Second, we propose an ensemble model that combines the best ML and DL models to achieve high-performance metrics. Finally, we benchmarked our best models with the CIC-IDS2017 dataset and compared them with state-of-the-art models. While the popular IDS datasets like KDD99 and NSL-KDD fail to represent the recent attacks and suffer from network biases, CIDDS, used in this research, encompasses labeled flow-based data in a simulated office environment with both updated attacks and normal usage. Furthermore, both accuracy and interpretability must be considered while implementing AI models. Both ML and DL models achieved an accuracy of 99% on the CIDDS dataset with a high detection rate, low false alarm rate, and relatively low training costs. Feature importance was also studied using the Classification and regression tree (CART) model. Our models performed well in 10-fold cross-validation and independent testing. CART and convolutional neural network (CNN) with embedding achieved slightly better performance on the CIC-IDS2017 dataset compared to previous models. Together, these results suggest that both ML and DL methods are robust and complementary techniques as an effective network intrusion detection system.

Towards Data-Driven Network Intrusion Detection Systems: Features Dimensionality Reduction and Machine Learning

Machine learning approaches to network intrusion detection for contemporary internet traffic

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection

Feature Analysis for Machine Learning-based IoT Intrusion Detection

Optimizing intrusion detection in 5G networks using dimensionality reduction techniques

Feature Extraction for Machine Learning-based Intrusion Detection in IoT Networks

Network intrusion detection system: machine learning approach

A Novel Method for Feature Learning and Network Intrusion Classification

Novel Framework for an Intrusion Detection System Using Multiple Feature Selection Methods Based on Deep Learning

Machine Learning Methods for Network Intrusion Detection

Analysis of Different Dimensionality Reduction Techniques and Machine Learning Algorithms for an Intrusion Detection System

Performance Analysis of Anomaly-Based Network Intrusion Detection Using Feature Selection and Machine Learning Techniques

A Deep Learning-Based Framework for Feature Extraction and Classification of Intrusion Detection in Networks

Machine learning to improve the performance of anomaly-based network intrusion detection in big data

Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems

Intrusion detection system over real-time data traffic using machine learning methods with feature selection approaches

An empirical evaluation for the intrusion detection features based on machine learning and feature selection methods

Relevant Feature Selection Model Using Data Mining for Intrusion Detection System

Intrusion detection system using classification algorithms with feature selection mechanism over real-time data traffic

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

Apache Spark and Deep Learning Models for High-Performance Network Intrusion Detection Using CSE-CIC-IDS2018